dependency-audit
Use when auditing project dependencies for security vulnerabilities, outdated packages, or license compliance across npm/yarn/pnpm, pip, go, and cargo.
- Installs
- 989
- Last 24h
- —
- Trending rank
- —
- Security
- Not audited
Install
Works with every agent the skills CLI supports.
npx skills add https://github.com/wu529778790/shenzjd-skills --skill dependency-audit- 01
Install
Run the command in your project. The CLI asks which agents to install for.
- 02
Describe the task
Ask your agent for something this skill covers. It loads dependency-audit automatically when relevant.
- 03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.
SKILL.md
The instructions your agent reads when the skill is triggered.
Dependency Audit
扫描项目依赖，检测安全漏洞、过时包和 license 合规问题。
Overview
全面审计项目依赖：CVE 漏洞扫描、过时依赖检测、license 合规检查、重复依赖分析。输出按严重程度排序的安全报告和可执行的修复命令。
When to Use
- User wants to check dependency security
- User mentions CVE, vulnerability, or audit
- User wants to know outdated dependencies
- User says "审计依赖" / "check dependencies"
- User inputs
/dependency-audit
When NOT to Use:
- User only wants to update versions
- User wants code-level security review
- User wants to analyze runtime dependencies
- User wants deep license analysis
- User wants to scan Docker images
Core Pattern
Step 1: 检测包管理器
| 检测文件 | 包管理器 | 审计命令 |
|---|---|---|
package-lock.json | npm | npm audit |
yarn.lock | yarn | yarn audit |
pnpm-lock.yaml | pnpm | pnpm audit |
go.sum | Go | govulncheck ./... |
requirements.txt / Pipfile.lock | Python | pip-audit |
Cargo.lock | Rust | cargo audit |
Step 2: 漏洞扫描
# 工具可用性检查（所有步骤共用）
check_tool() {
command -v "$1" >/dev/null 2>&1 || { echo "⚠️ $1 未安装，跳过 $2 审计"; return 1; }
}
核心命令（按包管理器分别执行，缺失工具自动跳过）：
⚠️
npm audit在发现漏洞时退出码非 0 —— 不要用if npm audit ...; then判断成功，直接解析--json输出：
| 包管理器 | 审计命令 |
|---|---|
| npm | npm audit --json | jq '.metadata.vulnerabilities.total' → 解析 vulnerabilities 数量 + 严重程度（勿依赖退出码） |
| Go | govulncheck ./... → 安装 golang.org/x/vuln/cmd/govulncheck@latest |
| Python | pip-audit → 安装: pip install pip-audit |
输出：漏洞总数 + 按严重程度（critical/high/medium/low）分类的 CVE 列表。
Step 3: 过时依赖检测
核心命令（按包管理器分别执行，缺失工具自动跳过）：
| 包管理器 | 检测命令 |
|---|---|
| npm | npx npm-check-updates --format table |
| Go | go list -m -u all | grep "\[" |
| Python | pip list --outdated |
统计：过时依赖数量、major/minor/patch 升级分布、是否有安全相关更新。
Step 4: License 合规检查
核心命令（按包管理器分别执行）：
| 包管理器 | 检测命令 |
|---|---|
| npm | npx license-checker --json → 按许可证类型统计数量 |
| Go | go-licenses csv ./... → 安装: go install github.com/google/go-licenses@latest |
检测重点：GPL/AGPL 等 copyleft 许可证、未知/自定义许可证、许可证兼容性。
Step 5: 生成报告
使用 templates/audit-report.md 模板，输出：
- 安全概览 — 漏洞数量和严重程度分布
- 高危漏洞 — 需要立即修复的 CVE
- 过时依赖 — 按升级难度排序
- License 合规 — 风险许可证列表
- 修复命令 — 每个问题附带可执行命令
Quick Reference
/dependency-audit # 完整审计
/dependency-audit --security # 只检查安全漏洞
/dependency-audit --licenses # 只检查 license
/dependency-audit --fix # 自动修复可安全升级的依赖
| 参数 | 说明 | 默认值 |
|---|---|---|
--security | 只检查安全漏洞 | false |
--licenses | 只检查 license 合规 | false |
--fix | 自动修复 | false |
Common Mistakes
| 错误 | 正确做法 | 原因 |
|---|---|---|
| 只看 high/critical | medium 也需要关注 | 很多攻击链从 medium 升级而来 |
| 盲目升级所有依赖 | 逐个升级并测试 | major 升级可能有 breaking changes |
| 不检查 transitive 依赖 | 分析完整依赖树 | 漏洞常出在间接依赖中 |
| 忽略 license 合规 | 定期检查 license | GPL 传染性风险 |
| audit 后不更新 lock 文件 | 重新生成 lock 文件 | 确保修复生效 |
| 忽略已弃用的依赖 | 检查弃用警告 | 弃用包可能有安全风险 |
FAQ
What does the dependency-audit skill do?
Use when auditing project dependencies for security vulnerabilities, outdated packages, or license compliance across npm/yarn/pnpm, pip, go, and cargo.
How do I install dependency-audit?
Run npx skills add https://github.com/wu529778790/shenzjd-skills --skill dependency-audit in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/dependency-audit/ (personal) or .claude/skills/dependency-audit/ (project).
Which AI agents can use dependency-audit?
Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.
Is dependency-audit safe to install?
No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.
Who maintains dependency-audit?
It is published by wu529778790 in wu529778790/shenzjd-skills. It has 989 recorded installs.
More from wu529778790/shenzjd-skills
docker-build-deploy
wu529778790/shenzjd-skills
Use when containerizing a Node.js app and setting up GitHub Actions CI/CD to build, push to GHCR, and deploy via SSH. Multi-stage build, non-root user, caching.
git-hooks-setup
wu529778790/shenzjd-skills
Use when setting up git hooks (pre-commit, commit-msg, pre-push) with husky or native hooks for linting, formatting, commit conventions, and secret scanning.
db-migration-helper
wu529778790/shenzjd-skills
Use when generating database migration SQL from model or schema changes — compares current vs desired schema, detects diffs, outputs reversible safe migrations.
github-profile-beautifier
wu529778790/shenzjd-skills
Use when creating or improving a GitHub profile README — themed stats cards, project showcase, tech-stack badges, and typing banner. 5 themes, smart project ranking (snake contribution graph needs separate setup).
api-doc-generator
wu529778790/shenzjd-skills
Use when generating OpenAPI/Swagger API docs from existing code — scans routes/annotations, extracts params and responses, outputs a YAML/JSON spec.
performance-profiler
wu529778790/shenzjd-skills
Use when profiling a Node/Go/Python project for performance bottlenecks — bundle size, dependency bloat, large files, unused code — and outputting prioritized optimization recommendations.
Popular security skills
azure-compliance
microsoft/azure-skills
Run Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: compliance scan, security audit, BEFORE running azqr (compliance cli tool), Azure best practices, Key Vault expiration check, expired certificates, expiring secrets, orphaned resources, compliance assessment.
minimal-run-and-audit
lllllllama/rigorpilot-skills
Rigor Run skill for README-first deep learning repo reproduction. Use when the task is specifically to capture or normalize evidence from the selected smoke test or documented inference or evaluation command and write standardized reprooutputs/ files, including patch notes when repository files changed. Do not use for training execution, initial repo intake, generic environment setup, paper lookup, target selection, hidden scientific-meaning changes, or end-to-end orchestration by itself.
seo-audit
coreyhaines31/marketingskills
When the user wants to audit, review, or diagnose SEO issues on their site. Also use when the user mentions "SEO audit," "technical SEO," "why am I not ranking," "SEO issues," "on-page SEO," "meta tags review," "SEO health check," "my traffic dropped," "lost rankings," "not showing up in Google," "site isn't ranking," "Google update hit me," "page speed," "core web vitals," "crawl errors," "indexing issues," "stuck on page 2," "striking distance keywords," "title tag rewrite," "low CTR," "local SEO," "Google Business Profile," or "map pack." Use this even if the user just says something vague like "my SEO is bad" or "help with SEO" — start with an audit. For building pages at scale to target keywords, see programmatic-seo. For adding structured data, see schema. For AI search optimization, see ai-seo.
firebase-security-rules-auditor
firebase/agent-skills
Audits Firebase (Firestore, Cloud Storage) security rules for vulnerabilities, privilege escalation, role bypasses, create vs update inconsistencies, resource exhaustion, type safety, size limits, and hasOnly ownership checks. Use when auditing/reviewing rules, running red-team rule assessments, or scoring against auditor checklists. Don't use for Firebase CLI (login, deploy), Auth, Crashlytics, Remote Config, or database queries.
audit
pbakaus/impeccable
Run technical quality checks across accessibility, performance, theming, responsive design, and anti-patterns. Generates a scored report with P0-P3 severity ratings and actionable plan. Use when the user wants an accessibility check, performance audit, or technical quality review.
competitors
coreyhaines31/marketingskills
When the user wants to create competitor comparison or alternative pages for SEO and buyer-facing use. Also use when the user mentions 'alternative page,' 'vs page,' 'competitor comparison,' 'comparison page,' '[Product] vs [Product],' '[Product] alternative,' 'competitive landing pages,' 'how do we compare to X,' 'competitor teardown,' 'audit our competitor pages,' 'are our comparison pages out of date,' or 'competitive asset audit.' Use this for any content that positions your product against competitors. Covers four formats: singular alternative, plural alternatives, you vs competitor, and competitor vs competitor. For auditing existing claims (not researching competitors from scratch, which is competitor-profiling; not technical SEO on these pages, which is seo-audit), use the asset audit here. For internal battle cards and sales-specific competitor docs, see sales-enablement.